In my active directory I currently have a GPO on the domain object that contains a logon script.

I want to create a new group that I can add users to and have it run an additional / different logon script.

I tried creating a new OU, put the group inside the OU, added the user to the group. In the OU I created a GPO and set the user logon script - I used the browse button to navigate to the script file. The UNC path looks correct and I verified the user/machine can actually get to it and run it properly.

The problem is it does not seem to work. I reboot the machine, logon, the script does not seem to run.

I am guessing it may be because of the logon script in the other domain GPO (which is set to do not override) (maybe it's the do not override that's the problem...?) ?

Can you only have one logon script defined from a single GPO, or are you able to have multiple GPO's each with logon scripts?


Yes it's entirely possible to have multiple logon scripts run in multiple GPO's, but maybe not quite in the way you want.

First Option

This method works quite well for us, however your needs may be different. Have multiple OU's and Sub-OU's and apply different GPO's with linked logon scripts further down the chain.

Take the following OU structure - I have a Global Logon Script GPO linked at Acme Widgets, an Internal Logon Script GPO linked at Internal and various department-specific logon scripts below that. Actually, I have multiple logon scripts linked at Acme Widgets and Internal for XP, Vista and 7 which are applied according to an OS version WMI filter on the GPO.

Acme Widgets 
    Human Resources

Second Option

This sounds like it is more similar to what you're after. Create your GPO's, add your logon scripts to them and link them all to an appropriate OU. Modify the permissions of the GPO so that only members of a specific group have permission to read the GPO, and apply it.

As for why the script isn't applying, here's my usual troubleshooting steps.

  • The Group Policy client does log some things in the event log. Check for any warnings or errors that may be preventing your scripts from running.
  • Run the script interactively after logging on (i.e go to \\SVR\Scripts\Logon.vbs and execute it). If you suppress errors or warnings, enable them before you run the script. Also, run this as a standard user - not an administrative one.
  • For Windows XP, run gpresult > GP.txt and check what policies you are being given, what are being filtered out etc. The /v switch (verbose) can also be useful, and if you really want information overload try the /z (super-verbose) switch.
  • For Windows Vista and above, use gpresult /h GP.html to create a much nicer output of the Group Policies you are getting. It opens in Internet Explorer and is pretty much the same as the RSOP summary you get in the Group Policy Management Console.
  • If you're on a laptop, the wireless may not be connecting immediately and may only do so upon logon, and after the logon scripts are supposed to have run. Maybe check for updated wireless drivers, but you may be stuck with this one. I know I have some laptops which don't work wirelessly very well unless you connect with the Intel crapplet they provide, which only connects after logon.

Is the new OU a sub-OU of the one where the first logon script GPO is linked? On the machine that should get the new logon script run gpresult and look to see if the new GPO has been filtered out. You may need to set the new logon script GPO as enforced.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.